Google takes down a 1.3-million-device TV-box botnet and bans the Chinese maker it says built the backdoor in
BleepingComputer details how the backdoor shipped in firmware and was rented out to residential-proxy and ad-fraud operators.
Google and partners including Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI have disrupted XCPE, a botnet of more than 1.3 million Android TV boxes and other devices in over 200 countries. Google's Threat Intelligence Group says "with high confidence" that Shenzhen device maker Videostrong Technology built the backdoor into its firmware during manufacturing and sold access to criminal affiliates.
Those affiliates installed modules for ad fraud and residential-proxy services, which route other people's traffic through the owner's home connection, according to BleepingComputer. Google says it also took down command servers used by more than a dozen related malware families, cutting off at least 10 million more compromised devices, including set-top boxes, karaoke machines and telehealth hardware.
Google has cut ties with Videostrong and banned it and future affiliates from making certified Android devices. The Register notes Videostrong did not immediately respond, and that XCPE belongs to the same ecosystem as BadBox 2.0, disrupted in 2025.
-
Botnet
After exploring Google disrupts million-device XCPE Android malware botnet, bans TV box maker, how botnets work is explained in Botnet.
A botnet is a group of internet-connected devices running bots, which can be used for denial-of-service attacks, data theft and spam, controlled through command-and-control software.
Wikipedia · Wade · 5 min
0